CVE-2026-78678— GitPython before 3.1.59 Arbitrary File Read via Repo.blame()
Quick assessment
Affected
gitpython-developers GitPython
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
GitPython 在 3.1.59 版本之前存在一个不安全的问题：在 检查中使用的拒绝列表不完整，遗漏了对 和 选项的防护。攻击者可以通过向 方法传递这些选项，读取任意文件。例如，攻击者可以传入类似 的修订值，从而通过 操作返回的结果泄露文件内容。
Possible ATT&CK Techniques 1 AI
T1005 · Data from Local SystemAffected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| gitpython-developers | GitPython | < 3.1.59 |
affected |
3.1.59 |
unaffected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-78678
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
GitPython before 3.1.59 Arbitrary File Read via Repo.blame()
Source: CVE Program / CVE List V5
Vulnerability Description
GitPython versions before 3.1.59 contain an incomplete denylist in the unsafe_git_revision_options guard that omits --contents and -S options, allowing attackers to read arbitrary files by passing these options to Repo.blame(). Attackers can supply revision values like --contents=/etc/passwd to leak file contents through the blame result returned to the caller.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
参数注入或修改
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| gitpython-developers | GitPython | 0 ~ 3.1.59 | - |
|
II. Public POCs for CVE-2026-78678
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-78678
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-78678 (2)
Same Patch Batch · gitpython-developers · 2026-08-25 · 5 CVEs total
| CVE-2026-78676 | 9.8 CRITICAL | GitPython before 3.1.59 Remote Code Execution via Config Injection |
| CVE-2026-78675 | 8.4 HIGH | GitPython before 3.1.59 Local File Content Disclosure via .gitmodules |
| CVE-2026-78677 | 7.5 HIGH | GitPython before 3.1.59 Path Traversal via separate-git-dir |
| CVE-2026-78679 | 6.5 MEDIUM | GitPython before 3.1.59 Arbitrary File Read via TagReference.create |
IV. Related Vulnerabilities
Same product: GitPython
-
CVE-2026-78679
GitPython before 3.1.59 Arbitrary File Read via TagReference -
CVE-2026-78677
GitPython before 3.1.59 Path Traversal via separate-git-dir -
CVE-2026-78676
GitPython before 3.1.59 Remote Code Execution via Config Inj -
CVE-2026-78675
GitPython before 3.1.59 Local File Content Disclosure via .g -
CVE-2026-76222
GitPython before 3.1.58 Path Traversal via .gitmodules Submo
Same vendor: gitpython-developers
-
CVE-2026-78679
GitPython before 3.1.59 Arbitrary File Read via TagReference -
CVE-2026-78677
GitPython before 3.1.59 Path Traversal via separate-git-dir -
CVE-2026-78676
GitPython before 3.1.59 Remote Code Execution via Config Inj -
CVE-2026-78675
GitPython before 3.1.59 Local File Content Disclosure via .g -
CVE-2026-76222
GitPython before 3.1.58 Path Traversal via .gitmodules Submo
Same weakness: CWE-88
-
CVE-2026-80427
bestzip before 2.2.6 and 3.0.x before 3.0.2 Argument Injecti -
CVE-2026-79675
NLTK before 3.10.3 JVM Argument Injection via Per-Call Optio -
CVE-2026-78637
Fdawgs node-poppler Argument Injection index.js pdfUnite arg -
CVE-2026-78676
GitPython before 3.1.59 Remote Code Execution via Config Inj -
CVE-2026-68766
hashcat through 7.1.2 Arbitrary File Write via Restore File
V. Comments for CVE-2026-78678
No comments yet